Description
In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
Remediation
References
https://github.com/developmentil/ecdh/issues/3
Related Vulnerabilities
CVE-2022-1365 Vulnerability in npm package cross-fetch
CVE-2023-41037 Vulnerability in maven package org.webjars.npm:github-com-openpgpjs-openpgpjs
CVE-2020-15135 Vulnerability in npm package save-server
CVE-2022-40764 Vulnerability in npm package snyk-go-plugin
CVE-2019-10352 Vulnerability in maven package org.jenkins-ci.main:jenkins-core